Does what it says. I looked at the code (scripts/bg.js inside of the .xpi for version 0.0.1), and it's four lines of code that add an onClicked callback that prefixes the string 'https://12ft.io/' to the current tab's url and then loads it. Simple, safe.